XEngineers/CamTalk
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 添加 JWT 鉴权拒绝日志

Browse Source
This commit is contained in:
hhs
2026-06-21 22:13:15 +08:00
parent 939e43acd0
commit 0a59173476
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
backend/internal/auth/middleware.go
View File

@@ -5,6 +5,8 @@ import (
"strings" "strings"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
"github.com/hhs/camtalk/internal/trace"
) )
// contextKey 用于在 Gin context 中存储 Claims 的 key。 // contextKey 用于在 Gin context 中存储 Claims 的 key。
@@ -17,8 +19,13 @@ const (
// 校验成功后将 user_id 和 username 写入 Gin Context。 // 校验成功后将 user_id 和 username 写入 Gin Context。
func AuthMiddleware(tokenMgr *TokenManager) gin.HandlerFunc { func AuthMiddleware(tokenMgr *TokenManager) gin.HandlerFunc {
return func(c *gin.Context) { return func(c *gin.Context) {
log := trace.FromContext(c.Request.Context())
authHeader := c.GetHeader("Authorization") authHeader := c.GetHeader("Authorization")
if authHeader == "" { if authHeader == "" {
log.Warnw("auth rejected",
"client_ip", c.ClientIP(),
"path", c.Request.URL.Path,
"reason", "missing authorization header")
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{ c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
"code": "INVALID_TOKEN", "code": "INVALID_TOKEN",
"message": "missing authorization header", "message": "missing authorization header",
@@ -29,6 +36,10 @@ func AuthMiddleware(tokenMgr *TokenManager) gin.HandlerFunc {
// 提取 Bearer token // 提取 Bearer token
parts := strings.SplitN(authHeader, " ", 2) parts := strings.SplitN(authHeader, " ", 2)
if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") { if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
log.Warnw("auth rejected",
"client_ip", c.ClientIP(),
"path", c.Request.URL.Path,
"reason", "invalid authorization format")
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{ c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
"code": "INVALID_TOKEN", "code": "INVALID_TOKEN",
"message": "invalid authorization format", "message": "invalid authorization format",
@@ -38,6 +49,11 @@ func AuthMiddleware(tokenMgr *TokenManager) gin.HandlerFunc {
claims, err := tokenMgr.ValidateAccess(parts[1]) claims, err := tokenMgr.ValidateAccess(parts[1])
if err != nil { if err != nil {
log.Warnw("auth rejected",
"client_ip", c.ClientIP(),
"path", c.Request.URL.Path,
"reason", "invalid or expired token",
"error", err)
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{ c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
"code": "INVALID_TOKEN", "code": "INVALID_TOKEN",
"message": "invalid or expired token", "message": "invalid or expired token",